ILM and alias error

[grumo35]

Hi,

i've followed the ILM setup guide and came accross this error
"illegal_argument_exception: index.lifecycle.rollover_alias [test-alias] does not point to index x"

Index Lifecycle Management "does not point to index" error

Lots of great questions. Let me try to give you some pointers. ILM is typically used in combination with rollovers. The rollover API causes new indexes to be created continuously. Initially, all of your data goes into an index called something like logs-000001. After that index reaches a certain age or a certain size, it "rolls over" to a new index logs-000002 and all new data will go to that new index. After a while, that index will rollover to a new index logs-000003 etc etc. Now, your appli…

Now i understand that you should create the index alias not in the index mapping but when the first index is created.

However i have 300+ indices that i would like to delete after a certain time, putting an ilm policy and delete phase seems to be the best idea for me.

But i'm unable to figure out why the alias need to point to data if the index is deleted ? and how to setup such alias if indicies already exists ? should i make a wildcard to all my policy related indicies ?

[grumo35]

Hi,

I've created the alias corresponding the the indicies of my ilm policy.

POST _aliases
{
  "actions": [
    {
      "add": {
        "index": "filebeat-*",
        "alias": "test-alias"
      }
    }
  ]
}

My ilm policy was applied with the following call :

PUT _index_template/filebeat_template
{
  "index_patterns": ["filebeat-*"],                 
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 1,
      "index.lifecycle.name": "45-days-7-hot",      
      "index.lifecycle.rollover_alias": "test-alias"    
    }
  }
}

I still have this error

illegal_argument_exception: rollover target [test-alias] does not point to a write index

Followed this error i've created the write index pointing to my alias

PUT test-alias-01
{
  "aliases": {
    "test-alias": {
      "is_write_index": true
    }
  }
}

So what i dont understand is for my data to be deleted after 45 days why should i need to use the rollover mechanism and a DataStream ??

[grumo35]

After a while errors disapeared with the write index.

however, i still dont get why older indicies with the policy applied are not deleted

GET filebeat-x-2023.08.02/_ilm/explain

{
  "indices" : {
    "filebeat-x-2023.08.02" : {
      "index" : "filebeat-x-2023.08.02",
      "managed" : true,
      "policy" : "45-days-7-hot",
      "lifecycle_date_millis" : 1690988844545,
      "age" : "76.97d",
      "phase" : "hot",
      "phase_time_millis" : 1697629327710,
      "action" : "rollover",
      "action_time_millis" : 1695740696478,
      "step" : "check-rollover-ready",
      "step_time_millis" : 1697637727579,
      "is_auto_retryable_error" : true,
      "failed_step_retry_count" : 1581,
      "phase_execution" : {
        "policy" : "45-days-7-hot",
        "phase_definition" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_age" : "2d"
            }
          }
        },
        "version" : 5,
        "modified_date_in_millis" : 1697552390771
      }
    }
  }
}

The policy is delete after 45 days